How exactly do I vet these damn updates other than testing them one by one?
You probably shouldn't run versions of the operating system that came out significantly after the system you're running them on was conceived. This goes for most platforms save possibly Linux.
To your off-topic point, SSE2 debuted in 2000 and Windows 7 hit the scene in 2009. That's three generations in enterprise computing.
Practically speaking running Vista (2007) or later on machine that doesn't support SSE2 is asking a lot. It shouldn't get thrashed and not everyone's installation was thrashed; sometimes it is just bad luck. You roll the dice with Windows updates and sometimes even qualifying hardware gets fragged. I had a Windows 10 Pro machine brick itself a couple of months ago to the point that I had to make a restore image from an identical machine. I'm not keen on the restore images being modified with each Windows update but that's how Windows 10 is set up.
These days, any CPU that doesn't support hardware AES should probably be retired unless it is dedicated to some very specific purpose or doesn't involve the Internet.